warez.sl0p.foo

vulnerability research & proof-of-concept code

All findings are published under our Responsible Attribution Policy. We do not contact vendors. This site is the disclosure.

2026-07-06 OLS Namespace Sandbox Escape
0day — argv injection in the OpenLiteSpeed hostexec daemon. Validates only argv[0] against the allow-list; argv[1..N] pass unfiltered to execvpe(). On cPanel + exim: sandboxed PHP tenant → sendmail -be '${run{cmd}}' → arbitrary command execution outside the namespace sandbox. All OLS versions with namespace sandbox through current (v1.9.1).

0day sandbox-escape namespace shared-hosting cpanel
2026-07-06 CyberPanel Low-Priv → Root RCE
0day — two chained bugs: WAF-allowlisted cronCommand injection + unvalidated phpPath arbitrary file write as root. Write /etc/ld.so.preload → next root fork+exec loads attacker .so → uid=0 in under 5 seconds. Any authenticated user who owns a website. All CyberPanel versions through current.

0day privesc root shared-hosting
2026-07-06 OpenLiteSpeed H2→H1 Request Smuggling
Silent fix in OLS 1.9.1 — CRLF injection in :path pseudo-header splits one HTTP/2 request into two HTTP/1.1 requests on proxied backends. Bypass URL routing, reach unexposed endpoints, desync responses. All OLS reverse-proxy deployments < 1.9.1 affected.

h2 request-smuggling n-day silent-fix